_CMHIVE

Metadatacopy
struct _CMHIVE {
    struct _HHIVE Hive;/* 0x0  1552 */
    /* ── cacheline 24 boundary (1536 bytes) ── */
    void* FileHandles[6];/* 0x610  48 */
    /* ── cacheline 25 boundary (1600 bytes) ── */
    struct _LIST_ENTRY NotifyList;/* 0x640  16 */
    struct _LIST_ENTRY HiveList;/* 0x650  16 */
    struct _LIST_ENTRY PreloadedHiveList;/* 0x660  16 */
    struct _EX_RUNDOWN_REF HiveRundown;/* 0x670  8 */
    struct _CM_KEY_HASH_TABLE_ENTRY* KcbCacheTable;/* 0x678  8 */
    /* ── cacheline 26 boundary (1664 bytes) ── */
    unsigned long KcbCacheTableSize;/* 0x680  4 */
    /* 4 bytes padding */
    struct _CM_KEY_HASH_TABLE_ENTRY* DeletedKcbTable;/* 0x688  8 */
    unsigned long DeletedKcbTableSize;/* 0x690  4 */
    unsigned long Identity;/* 0x694  4 */
    struct _CMSI_RW_LOCK HiveLock;/* 0x698  8 */
    struct _RTL_BITMAP FlushDirtyVector;/* 0x6a0  16 */
    unsigned long FlushDirtyVectorSize;/* 0x6b0  4 */
    /* 4 bytes padding */
    struct CMP_OFFSET_ARRAY* FlushLogEntryOffsetArray;/* 0x6b8  8 */
    /* ── cacheline 27 boundary (1728 bytes) ── */
    unsigned long FlushLogEntryOffsetArrayCount;/* 0x6c0  4 */
    unsigned long FlushLogEntrySize;/* 0x6c4  4 */
    unsigned char FlushLogEntryIncludesHeader;/* 0x6c8  1 */
    /* 3 bytes padding */
    unsigned long FlushHiveTruncated;/* 0x6cc  4 */
    unsigned char FlushBaseBlockDirty;/* 0x6d0  1 */
    /* 7 bytes padding */
    struct _RTL_BITMAP CapturedUnreconciledVector;/* 0x6d8  16 */
    unsigned long CapturedUnreconciledVectorSize;/* 0x6e8  4 */
    /* 4 bytes padding */
    struct CMP_OFFSET_ARRAY* UnreconciledOffsetArray;/* 0x6f0  8 */
    unsigned long UnreconciledOffsetArrayCount;/* 0x6f8  4 */
    /* 4 bytes padding */
    /* ── cacheline 28 boundary (1792 bytes) ── */
    struct _HBASE_BLOCK* UnreconciledBaseBlock;/* 0x700  8 */
    struct _EX_PUSH_LOCK SecurityLock;/* 0x708  8 */
    unsigned long LastShrinkHiveSize;/* 0x710  4 */
    /* 4 bytes padding */
    union _LARGE_INTEGER ActualFileSize;/* 0x718  8 */
    union _LARGE_INTEGER LogFileSizes[2];/* 0x720  16 */
    struct _UNICODE_STRING FileFullPath;/* 0x730  16 */
    /* ── cacheline 29 boundary (1856 bytes) ── */
    struct _UNICODE_STRING FileUserName;/* 0x740  16 */
    struct _UNICODE_STRING HiveRootPath;/* 0x750  16 */
    unsigned long SecurityCount;/* 0x760  4 */
    unsigned long SecurityCacheSize;/* 0x764  4 */
    long SecurityHitHint;/* 0x768  4 */
    /* 4 bytes padding */
    struct _CM_KEY_SECURITY_CACHE_ENTRY* SecurityCache;/* 0x770  8 */
    struct _LIST_ENTRY SecurityHash[64];/* 0x778  1024 */
    /* ── cacheline 45 boundary (2880 bytes) ── */
    unsigned long UnloadEventCount;/* 0xb78  4 */
    /* 4 bytes padding */
    /* ── cacheline 46 boundary (2944 bytes) ── */
    struct _KEVENT** UnloadEventArray;/* 0xb80  8 */
    struct _CM_KEY_CONTROL_BLOCK* RootKcb;/* 0xb88  8 */
    unsigned char Frozen;/* 0xb90  1 */
    /* 7 bytes padding */
    struct _CM_DIRTY_VECTOR_LOG DirtyVectorLog;/* 0xb98  1160 */
    /* ── cacheline 64 boundary (4096 bytes) ── */
    unsigned long Flags;/* 0x1020  4 */
    /* 4 bytes padding */
    struct _LIST_ENTRY TrustClassEntry;/* 0x1028  16 */
    unsigned __int64 DirtyTime;/* 0x1038  8 */
    /* ── cacheline 65 boundary (4160 bytes) ── */
    unsigned __int64 UnreconciledTime;/* 0x1040  8 */
    struct _CM_RM* CmRm;/* 0x1048  8 */
    unsigned long CmRmInitFailPoint;/* 0x1050  4 */
    long CmRmInitFailStatus;/* 0x1054  4 */
    struct _KTHREAD* CreatorOwner;/* 0x1058  8 */
    struct _KTHREAD* RundownThread;/* 0x1060  8 */
    union _LARGE_INTEGER LastWriteTime;/* 0x1068  8 */
    struct _HIVE_WRITE_WAIT_QUEUE FlushQueue;/* 0x1070  16 */
    /* ── cacheline 66 boundary (4224 bytes) ── */
    struct _HIVE_WRITE_WAIT_QUEUE ReconcileQueue;/* 0x1080  16 */
    union {
        unsigned long FlushFlags;/* 0x1090  4 */
        struct {
            unsigned long PrimaryFilePurged : 1;/* 0x1090:0  4 */
            unsigned long DiskFileBad : 1;/* 0x1090:1  4 */
        };/* 0x1090  4 */
    };/* 0x1090  4 */
    unsigned long PrimaryFileSizeBeforeLastFlush;/* 0x1094  4 */
    volatile long ReferenceCount;/* 0x1098  4 */
    long UnloadHistoryIndex;/* 0x109c  4 */
    unsigned long UnloadHistory[128];/* 0x10a0  512 */
    /* ── cacheline 74 boundary (4736 bytes) ── */
    unsigned long BootStart;/* 0x12a0  4 */
    unsigned long UnaccessedStart;/* 0x12a4  4 */
    unsigned long UnaccessedEnd;/* 0x12a8  4 */
    unsigned long LoadedKeyCount;/* 0x12ac  4 */
    volatile unsigned long HandleClosePending;/* 0x12b0  4 */
    /* 4 bytes padding */
    struct _EX_PUSH_LOCK HandleClosePendingEvent;/* 0x12b8  8 */
    /* ── cacheline 75 boundary (4800 bytes) ── */
    unsigned char FinalFlushSucceeded;/* 0x12c0  1 */
    /* 7 bytes padding */
    struct _CMP_VOLUME_CONTEXT* VolumeContext;/* 0x12c8  8 */
    unsigned long LateUnloadWorkItemState;/* 0x12d0  4 */
    /* 4 bytes padding */
    struct _EX_PUSH_LOCK LateUnloadFinishedEvent;/* 0x12d8  8 */
    struct _WORK_QUEUE_ITEM* LateUnloadWorkItem;/* 0x12e0  8 */
};